Baselines.
We compare our method with two baseline gradient inversion attacks: Inverting Gradients (IG; [1]}), a representative optimization-based method, and Gradient Inversion with Generative Image Prior (GI-GIP; [2]}), the state-of-the-art optimization-based method that uses a generative model to encode the data prior. We make minor modifications to these attacks to adapt them to various defenses; see appendix for details. The threat model for our attack is most similar to GI-GIP since both use an auxiliary dataset to encode the data prior.
